Then connect to the new network from iPhone over WiFi. (SystemPreferences->Sharing->InternetSharing)

If you're after sniffing these packets on Windows, connect to the internet using Ethernet, share your internet connection, and use the Windows computer as your access point. Then, just run Wireshark as normal and intercept the packets flowing through, filtering by their startpoints. Alternatively, try using a network hub as Wireshark can trace all packets flowing through a network if they are using the same router endpoint address (as in a hub).

The blog post does not make one thing clear: how do you get the address to use for the proxy? What you should do is startup the "network utility" app on your mac. You will see an "IP Address" on the Info tab (the first tab). That is the address you should use.
–
William JockuschOct 2 '12 at 3:20

The instructions in the link are really bad. There are tons of people who can't get it working (see the comments). The author appears to arbitrarily pick an IP address to act as the proxy. But it should be the IP address of the computer/laptop.
–
Mike SlutskyMar 27 '14 at 14:36

On your iPhone, go to Settings > Wifi and choose your Mac as the Wifi Access Point. Press the blue detail disclosure next to it to and note down the IP Address (192.168.2.2 in my case). At this point, the wifi icon on Mac's your taskbar should change to the following:

Open wireshark. Click on start capture, and use the new bridge interface that should now be available among the options.

???

Profit!

As with all stuff networking related, you might have to restart wifi etc and repeat steps and invoke your favorite deity to get this incantation working :)

Charles is an HTTP proxy / HTTP monitor / Reverse Proxy that enables a developer to view all of the HTTP and SSL / HTTPS traffic between their machine and the Internet. This includes requests, responses and the HTTP headers (which contain the cookies and caching information).

Validate recorded HTML, CSS and RSS/atom responses using the W3C validator

It's cross-platform, written in JAVA, and pretty good. Not nearly as overwhelming as Wireshark, and does a lot of the annoying stuff like setting up the proxies, etc. for you. The only bad part is that it costs money, $50 at that. Not cheap, but a useful tool.

The easiest way of doing this will be to use wifi of course. You will need to determine if your wifi base acts as a hub or a switch. If it acts as a hub then just connect your windows pc to it and wireshark should be able to see all the traffic from the iPhone. If it is a switch then your easiest bet will be to buy a cheap hub and connect the wan side of your wifi base to the hub and then connect your windows pc running wireshark to the hub as well. At that point wireshark will be able to see all the traffic as it passes over the hub.

I had to do something very similar to find out why my iPhone was bleeding cellular network data, eating 80% of my 500Mb allowance in a couple of days.

Unfortunately I had to packet sniff whilst on 3G/4G and couldn't rely on being on wireless. So if you need an "industrial" solution then this is how you sniff all traffic (not just http) on any network.

Basic recipe:

Install VPN server

Run packet sniffer on VPN server

Connect iPhone to VPN server and perform operations

Download .pcap from VPN server and use your favourite .pcap analyser on it.

Check that you can connect your iPhone to the VPN. I did this by downloading the free OpenVPN software. I then set up a OpenVPN certificate. You can embed your ca, crt & key files by opening up and embedding the --- BEGIN CERTIFACTE --- ---- END CERTIFICATE --- in < ca > < /ca > < crt >< /crt>< key > < /key > blocks. Note that I had to do this in Mac with text editor, when I used notepad.exe on Win it didn't work. I then emailed this to my iphone and picked installed it.

Check the iPhone connects to VPN and routes it's traffic through (google what's my IP should return the VPN server IP when you run it on iPhone)

Now that you can connect go to your linux server & install wireshark (yum install wireshark)

This installs tshark, which is a command line packet sniffer. Run this in the background with screen tshark -i tun0 -x -w capture.pcap -F pcap (assuming vpn device is tun0)

Now when you want to capture traffic simply start the VPN on your machine

When complete switch off the VPN

Download the .pcap file from your server, and run analysis as you normally would. It's been decrypted on the server when it arrives so the traffic is viewable in plain text (obviously https still encrypted)

Note that the above implementation is not security focussed it's simply about getting a detailed packet capture of all of your iPhone's traffic on 3G/4G/Wireless networks